Do You Allow Webmail Use on Your Network? 487
rtobyr asks: "I don't allow users at my organization to use any third party e-mail. When users complain, I point out that we can't control the security policies of outside systems. End users tend to think that big business will of course have good security; so I ran a test of the 'Big Four': Hotmail, Yahoo Mail, AOL/AIM Mail, and GMail. Yahoo Mail was the only webmail provider to allow delivery of a VBS script. GMail was the only provider to block a zipped VBS script. End users also tend to think that a big business would never pull security features out from under their customers. Of course, we know that AOL and Microsoft have both compromised the security of their customers. I don't know of any security related bad press for Yahoo or Google. Three of my Big Four either allow VBS attachments or have a poor security track records. So, if you are a network administrator, do you limit your users' ability to use third party e-mail, and if so, do you allow for GMail or other providers that you've deemed to have secure systems and reputations?"
How? (Score:3, Informative)
Re:How? (Score:4, Insightful)
Right Choice, Wrong Reasons (Score:5, Insightful)
He should be asking himself, "Why do the people who work here feel they need to use the non-corporate system for business work?"
All my work email goes from my work account, personal goes thru gmail.
Also, if he doesn't allow people to use personal accounts for personal email, they'll just use the company email for that. Does he want that to happen?
Re:Right Choice, Wrong Reasons (Score:4, Interesting)
Re: (Score:3, Insightful)
If you insist on adopting this kind of totalitarian approach, don't be surprised if your employees screw you. As I said elsewhere, trust has to work both ways.
Re:Right Choice, Wrong Reasons (Score:5, Insightful)
Hey, you could try banning personal phone calls at work, too. Let us know how that works out for you in a couple of years... if you're still in business.
Seriously, employees do not cease to become human when they walk through the office door. It is unreasonable (and indeed illegal, in some places) to expect them to work like machines, denied access to private communication with anyone outside the business during office hours, denied time off when they're sick or for medical check-ups, and so on.
Fortunately for all of us, it's rarely necessary to invoke such laws. Companies that abuse their staff (and that's exactly what this sort of thing is) will simply see all their staff walk, starting with the really good people, who find it easiest to find more pleasant conditions elsewhere. Meanwhile, companies with more enlightened, employee-friendly policies eat up good people for very modest costs and wonder what the problem is all about.
Re: (Score:3, Insightful)
Why is webmail blocked but USB ports allow anyone to plug and play a thumb drive? Couldn't someone bring a virus in the same way?
Why do we block webmail but no other websites/services are blocked? Shouldn't we worry about someone surfing for pr0n or possibly looking for warez?
Often, I have heard the argument that IT doesn't want to let information get leaked via webmail and IM's. But all computers at my
Re: (Score:3, Insightful)
Re:How? (Score:5, Insightful)
Why is webmail blocked but USB ports allow anyone to plug and play a thumb drive? Couldn't someone bring a virus in the same way?
And if they blocked up the usb ports, someone could come in with a SATA drive and a screw driver. Couldn't someone bring in a virus that way too? So why not install intrusion detection systems in all the cases...?? And on it goes.
The answer: risk/cost analysis indicates that email is by FAR the number 1 transport for viruses. Yes other vectors exist, but if you only deal with email you address the lions share of the risk.
Additionally, removing webmail is usually aligns with managements objectives, so blocking it generally gets immediate management support.
Why do we block webmail but no other websites/services are blocked? Shouldn't we worry about someone surfing for pr0n or possibly looking for warez?
The answer: risk/cost analysis again. You address the big problems before the little ones, and the little ones before the ones you don't even have (yet). IE - Knock out MSN/Yahoo/Gmail and you remove a huge chunk of the useless sites that staff ARE spending hours on. If its worth it, you could keep going after every porn or warez site too, but the returns rapidly diminish while the cost keeps going higher.
If surfing porn/warez was a rampant problem then you could expect management to address it with technology. But for most companies a policy against warez and porn is usually enough to keep the problem at minimal levels. (Hell, most of the time you don't even need formal policy, in my experience most people just 'know better' and don't have to be told that surfing porn at work is against policy and grounds to be fired.)
Weaning webmail addicts off their personal accounts, on the other hand, sometimes requires a little help from technology.
Re: (Score:2)
Two fold method:
1. Content Filter
2. By an acceptable use policy stating the equipment is for work only and any deviance could lead to dismissal.
Maybe a bit draconian but we do have separate machines that are sandboxed that they can use for surfing "work-unfriendly" sites.
Re:How? (Score:4, Informative)
Another reason, that isn't documented here, that people would want to block external communications (AIM, GMail, whatever) would be legal requirements to document any communication with a client. This would especially include banks, security companies, etc. I know that financial institutions are required to archive all email communication forever, literally. Morgan Stanley got into huge trouble because they didn't. In order to control the flow of information, most banks just block external email services so the content is easier to control.
re: how? (Score:2)
ed
Re: (Score:3, Insightful)
Re: (Score:2, Insightful)
That said, there are simple workarounds. If your employer has some sort of SOCKS proxy, that's very simple to SSH through.
Re:How? (Score:4, Interesting)
Except some people may NEED to do just that because of the stupid rules set up on the company mail servers.
For my work, I deal with a developer in another state and we have to exchange large files. From inside our network, I have way to ftp/ssh into his company servers to transfer the files. So, e-mailing is the only option. Our e-mail servers won't allow attachments that large.
So, we use gmail. It's not elegant, but we can easily send the files we need back and forth and actually get our work done.
Oh yes... our IT people are the same totalitarians you find everywhere (I used to be an admin, and back then, we actually tried to help our people do their jobs, not inhibit their work). So, they won't adjust the rules of our mail servers, or provide a way for me to connect to the other company's computers and transfer the files.
So there it is... IT's motto is "IT at the speed of business", but the reality is "business crawling at the bureaucratic speed of IT". It's like they believe that they are the revenue generating portion of the company and that the rest of the company exists to serve IT.
Sadly, that view is all too common.
Re: (Score:3, Interesting)
I have extremely strict rules set up on my network. I am pretty sure that the only one that hasn't been broken (with my authorization) is the pr0n rule.
I constantly take shit from other admin's who pride themselves on being an ass about their rules, but I have found that the best way to get business done is for every rule to have an exception.
All webmail is banned, blocked, filtered, and otherwise prohibited on my network. However, there have been
Re: (Score:3)
How often have GMail accounts been cracked and a companies IP been stolen because of that crack?
The problem with most security policies is they look at any potential angle of attack and block it, without regard to how likely that attack is versus the inconvenience/disruption of that block.
You might say that blocking third party email doesn't disrupt the function of the business, so it's no big deal. However, if you treat people like untrustworthy idiots, they're going to be less likely to want to go th
Re: (Score:2)
Yes, A moderately bright young chap could proxy his way around the content filtering. We have had those moderately bright chaps get fired for doing it as well.
Re:How? (Score:4, Insightful)
Way to remove your best talent there, chief.
And drive away the possibility of any new talent.
Re: (Score:3, Insightful)
And that, my friends, pretty much summarizes the arguments for and against expanding H-1B caps.
Re: (Score:3, Insightful)
Oh, so you do let them past the restrictions? Officially sanctioned and everything, I see? So basically you're telling me that your best talent would have no trouble defeating your measures (as I surmised) so you don't even try to put them in place for them? Why don't you try putting those measures in place for the researchers, a
Re: (Score:2)
Re:How? (Score:4, Insightful)
I have putty on my computer and I run everything through a SOCKS proxy. I have Firefox, Thunderbird (no webmail for me) and iTunes all going through one of my few shells.
I occasionally surf between 0 and 3 hours a day: fark, slashdot, ebay, etc. Last year I received the highest rating that someone of my salary level could. My boss, my coworkers think I'm a magic man, when I'm asked to get something done I get it done as fast as possible. Techno &/or 80's music tends to set a rhythm for my coding, despite internet radio being frowned on (not officially banned). My parents are going through a divorce. I like to e-mail both of them and my siblings during the day, but I like to keep that off of corporate mail. Sometimes I want to win an auction during work and sometimes I just need a detox.
With all due respect, you and your company can go fuck themselves. If I got the lowest rating, then yes, there's a problem. But you and your company are automatically removing people like me because we get stuff done AND we have personal lives.
Content filter the secretary not the MSMEs.
Re: (Score:3, Insightful)
Not really - he has a point... If you're considered a good employee that gets his work done, why should anyone care if you slack once in a while? I sometimes find myself slacking off on
Doesn't make me a bad employee unless I miss targets for stuff. GP is bang on. If I get stuff done, why should IT care if I waste some time checking my personal email?
And no, the whole "it can bring vbs files to
Re: (Score:2)
Now, isn't that silly? If you don't think so, imagine explaining how to unzip and rename files to business folks... especially if their Windows is setup to hide file extensions (many have no idea what a file extension is!).
In my opinion, cor
Stupidity! (Score:2, Flamebait)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Not a huge stretch for someone to make that malicious. I find myself more annoyed than not that you can't configure browsers these days to intelligently handle things that you just want to be able to view like
Re: (Score:2)
Re: (Score:2)
Re: (Score:2, Insightful)
Re: (Score:3, Informative)
Yes, and in this order [mapsofworld.com]
Think about it.
Re: (Score:2)
Re: (Score:3, Funny)
Re: (Score:3, Funny)
And you deserve what happened to you when you opened it!
(Yes, nothing happened. And you SO deserved it.)
Re:Monopoly blames the user again! (Score:4, Informative)
Your point?
Squirrelmail (Score:4, Interesting)
Where do you work? I'd like to know so that I do not inadvertently apply for work at your company.
Then again, I'm sure you've addressed all of your company's really important network concerns first before moving on to this. Or, maybe you were sure to restrict all of the workstations such that no one can change their desktop wallpaper and things like that.
Which webmail system do I use while at work? I use my own squirrelmail installation. I bet you'd really hate that!
Re:Squirrelmail (Score:5, Insightful)
Re: (Score:3, Insightful)
[Disclaimer: I do risk and reg for a living]
Bull. Sarbanes Oxley says nothing of the sort. If you think it does, go read the regs. I don't believe you are intentionally lying, I just think you are misinformed and have no idea what you are talking about.
Re: (Score:2, Insightful)
Re:vague regulations (Score:3, Interesting)
Re:Squirrelmail (Score:5, Funny)
Seriously man, paragraphs.
Re: (Score:3, Insightful)
I know SOX quite well, as internal SOX auditing is part of my job. Nice try. It seems like you're misinformed about SOX. SOX doesn't force IT departments to do anything, let alone "drastic measures."
Like I said in my original post, it's a good thing you're focused on the important activities of, "blocking mail apps, IM apps, USB drives and the like." You better ban laptops too! While you're at it, kill your users. They might *speak*. Well, you could rip out their vocal cords so they can't do that,
Shhh...don't tell him (Score:2)
One thing for sure... (Score:4, Insightful)
Seriously, webmail has so much use that blocking it is ultimately counterproductive -- the only equivalent "security" would be totally blocking net access.
If you are worried about productivity loss, well, I often use webmail so I can stay at work longer. Really, it's not hard to imagine that allowing people to use light net access for personal communication means that they do not have to physically leave work to do these things. It's a bonus for all.
If you are worried about security, any net access that allows submission of forms or uploading of files is equivalent security breach. As stated before, any moderately skilled hacker can configure a proxy to get data off your network.
You're crippling your users and kidding yourself.
Yes (Score:5, Insightful)
We would prefer that the work e-mail not be used for personal mailings. One of the reasons is file storage space.
We are willing acknowledge that the parents are going to communicate with their kids, and other folks with friends and family. It makes for better employee morale when they are permitted access to web mail for such things, leading to less abuse of work systems. It is better to use e-mail than the phone, which needs to be left free for actual business calls with clients.
Are there security concerns? Though the poster found some concerns, those concerns are easily disarmed by a good anti-virus/anti-spyware program.
Sure, we could be rather draconian and put the kabosh on all of it, but it comes back to employee morale. A happy worker is a productive worker. Our workers are given the task of being responsible and are rewarded for their success.
Re:Yes (Score:5, Insightful)
Re: (Score:2)
Re: (Score:2)
Limiting usage like this just makes an employee dislike their job that much more, and just as you said, unhappy workers are not nearly as productive as happy ones.
Re: (Score:2)
I was blocked from using altavista, and couldn't translate some emails, and couldn't get approval to buy the software. IT security tends to treat engineers as call centers, and lock them down. Those engineers tend to leave the company due to crappy office politics. Morale is important.
Re: (Score:2)
Blocking webmail just means you'll have more company signatures attached to forwards urging a boycott of Starbucks for being unamerican, grass roots campaigning for politicians, or a number of other things you're company doesn't officially support. Once that signature goes on there, someone's going to
Re: (Score:2)
If you have to setup a non-networked comput
Where I work... (Score:3, Interesting)
Shooting the messenger (Score:5, Insightful)
Re:Shooting the messenger (Score:4, Insightful)
Users are a pain! (Score:2, Funny)
Re:Users are a pain! (Score:5, Funny)
Muahahaha!
Re: (Score:2)
Re: (Score:2, Insightful)
Re: (Score:2)
Isn't it safer when their only communication device is a pencil and a piece of paper?
Stupid (Score:5, Interesting)
What's their secret? They take care of preventing stupid users from downloading crap themselves, meaning they scan at their proxy and/or firewall boundaries (I'm not a network admin here so I don't know exactly how it works).
This has been the policy for at least five years and they've never had a single problem. Never.
If a large financial services company can do it, I don't know why everyone else can't either. So you're asking the wrong question - instead, ask "how can I provide a better service to my users by allowing them to access their webmail and also maintain my network security?"
I've worked at companies that either completely or selectively block webmail access. Nothing personal, but you and other network admins like you suck rocks as far as I'm concerned. Trusting or distrusting the webmail provider because they do X or Y is supremely stupid because you're basically bending over for them and waiting for the inevitable vulnerability to show up. What, are you going to go to your CTO and say "well, I didn't trust Microsoft and AOL, but I thought Yahoo was OK! It's not my fault!"?
You should know better and you should do better. If you can't, just block all webmail and stop complaining about what other companies do or fail to do. It's your network and your responsibility.
Re: (Score:3, Informative)
We do the same thing at my place of work. We have a Cisco secur
At my company... (Score:5, Insightful)
I guess I understand that, but the bummer is that for a lot of us we don't work just your basic 9-5. If you work a lot its nice to be able to take care of a little personal business, in fact I think it probably increases productivity by making people more willing to hang around at work a little longer. So in that regard these bans are counterproductive.
I don't think IT people really think about stuff like that much...the ideal situation for IT isn't necessarily whats best for the enterprise. That said I can see how security and document retention are valuable goals...maybe webmail could provide some kind of mechanism to allow companies to hook into it and archive messages read or sent using corporate machines. Same for instant messengers. Then everyone's happy (except privacy advocates...)
May as well prohibit all web-browsing... (Score:5, Insightful)
Making a non-webmail page with links to nasty VBS scripts, etc. is just as easy as send an e-mail, so you are not really protecting your network by these annoying limitations... An attacker can send your charges an e-mail (at the corporate address) with a link to his script. And if you check all browsing (via scanning proxies), then you may as well leave webmails alone, for they'll be checked too, along with all other HTML pages.
You are not alone, unfortunately. I found, that whenever admins (pompously) argue for strict banishment of a particular "attack vector", they almost always ignore another vector for the same attack.
There could be one justification for banning external (non-corporate) means of communications, while at work — compliance and legal issues. A big bank, for example, does not want a broker to be able to claim, that a bank's trader ordered a (bad) trade via. GMail or cell-phone. But this only makes sense, when your official (corporate) communications get recorded and archived (unlike private webmail accounts and personal cell-phones), and can be played back.
In short, you have to remember, that you (an administrator) exist for the benefit and convenience of these people, not the other way around. So if they want to be able to access their webmail, you must have a much better reason than "you may get a virus" to deny it to them.
I bet, more productivity is lost, when an employee brings in flu and half the office gets sick. But no one is advocating forcing people to take vitamin C and wear scarves, right?..
Re: (Score:2)
You BOFH's especially need to remember this.
Re: (Score:2)
What? If they don't need it to do their job, that argument falls apart, and you must step back and fall on the argument that it's bad for morale if they don't get webmail.
Security makes me sad. (Score:2)
It's really depressing how limited our access to the Internet has become. Its mostly done to "boost" productivity or "prevent" litigation. Security concerns are now adding to that situation. I see a point in the not-so-distant future where businesses and corporations will be so worried about
Corporate email users are adults (Score:2)
People do this? (Score:5, Funny)
Re:People do this? (Score:4, Insightful)
IT Tough Guy (Score:3, Insightful)
Blocking webmail is pointless and serves only for you to needlessly flex your authority in the only part of the world you have authority: your company's network.
Seriously, if you are so paranoid about webmail, why allow internet to the desktop at all? Since you are so afraid of VBS, why don't you just lock out VBS execution at the desktop and keep your enterprise AV up2date?
Grow up, have kids, and annoy them with your stupid restrictions. Leave the people at work alone.
Much better solution (Score:5, Insightful)
A great topic and question! (Score:5, Informative)
I allow it (Score:2)
Honestly, I've always allowed webmail (and encouraged it) as a way to side-step a certain amount of responsibility for reporting users for things. It may sound crazy, but in my experience you can't stop users from e-mailing their friends, spouses, mistresses, and drug-dealers during the course of the work day.
I've had it happen where e-mails about an employee's drug habit get stuck in our spam filter, which means I saw them when I went through looking for false-positives. Suddenly, I'm in my own personal
I'd figure out a way to allow it (Score:2)
Speaking purely as a sysadmin, I'd block those sites utterly. Web-browser components are the biggest target of malware out there, it's bad enough when targeted at an e-mail client that can lock down scripting and such but Web-mail sites let that stuff through to a browser that has to allow scripting in a corporate environment. And if you're a business you've got your own e-mail system, no company e-mail should be going through a Web-mail system in the first place.
As a techie, no decision would affect me. I
Re: (Score:2)
Oh, and on follow-up, those outside e-mail addresses benefit the company too. When I'm travelling, I often can't reach the company mail system because it's not accessible outside the company network and the local firewalls and access setup at hotels often won't permit the VPN to connect properly. But almost always I can manage to get an SSH connection to my home machine through, and when I can't I can still use a Web browser to get at Web-mail, which means my bosses can reach me via my personal e-mail even
Using Webmail at work machine is NOT the issue (Score:2)
we block everything except for IT people (Score:2)
Comment removed (Score:4, Interesting)
Re:When users complain (Score:4, Insightful)
I work with similar issues: it can be interesting finding ways to get work done in spite of IT's (un)support and (un)help.
Re: (Score:3, Insightful)
Re:When users complain (Score:5, Insightful)
Thank you very much. Companies like yours are the reason companies like mine can hire brilliant and talented people away from bureaucratic nightmares and pay them 20% less while getting a significant amount more productivity from them. We have internal Web, IRC, chat, etc. servers. If your AOL IM is not working and it is stopping you from chatting with your girlfriend, IT is happy to help. They'll even grab you a beer from the fridge on the way to your desk. For smart people who know they'll spend a significant portion of their life at work, but who chose their work because they love it... there are companies like mine. You're treated like a real person instead of a cog. If you need to go home for the rest of the day while waiting for the plumber to come to your house, go ahead. Don't bother filling out paperwork or logging your time. So long as your work gets done, it's all to the good. If a friend is in town and stops by the office, go ahead and take a few hours to have a beer and play a video game with them in the lounge. Introduce them to your boss and coworkers.
We don't lock down Web access to any type of external site. We track everything, but the tracking system is open to all employees so if you want to see what your boss is doing, just log on and look. We don't seem to have a lot of IT emergencies either. Some of our old and out of date servers overheat or fall over now and again and we power cycle them. No big deal.
Every day I'm thankful I realized early in life that I did not want to take the top dollar offer for my work if it meant I had to put up with nonsense like you advocate. IT's job is not supposed to be to minimize the amount of work they need to do or even to prevent problems. It is supposed to be to facilitate the rest of the company getting work done. Happy employees work harder for the company and stay late to work on something or even come in on a weekend for some project. Happy employees do not quit and move to another company with no notice leaving the company in the lurch. Happy employees are not the largest and hardest to stop threat to the security of your network as they feel it is "wrong" to screw over the company and boss and people who treat them well and with understanding and who are their friends.
But by all means, keep making yourself hated and keep thinking your employees lives should stop and they should act like machines for 8 hours a day. We'll keep hiring away the smartest people you have.
In a free-wheeling educational environment (Score:2)
Webmail != insecure (Score:2)
Re: (Score:2)
Gmail is more usable! (Score:3, Insightful)
Here's an idea! How about IT look to the users as customers and treat them that way.
Security.... for what? (Score:5, Insightful)
If you're worried about virus/malware/etc... web based email is no more or less safe than any other modern graphical pop3/imap client. All of them these days are HTML enabled, and unless you personally watch everyone click their messages, some will still run winbig.exe or whatever.
Personally, I'm getting a bit tired of people tossing the "security" word around as a reason to make things more difficult or expensive, without ever justifying what it is that needs the added security, and why.
It should be a matter of give and take (Score:2)
Not in my office (small business) (Score:4, Insightful)
My girlfriend's company, which is a larger energy company of about 250 people, does however block some webmail content, as they recently had an employee download material that caused a security concern.
Personally, I don't think it's unreasonable to block web-based mail. However, since email is such a common place in daily life now, if I was to do that, I would make sure there were a few computers in a staff room where people could freely check their email, outside the companies' proxies and firewalls.
VBS and Firefox (Score:2)
General policy (Score:2)
Yes, we do for personal stuff (Score:2)
It has to be said that we do not have any monitoring or censoring policies. It is OK for somebody to write personal email in work from time to time untill that person does her job right.
But you have a certainly flawed reas
Compromise -- Terminal Server (Score:3, Insightful)
However with Terminal Services clients, I enable it to be used in a client window, and make sure that "Turn off clipboard redirection" is off in group policy. All employees can connect to a cluster of Terminal Servers which is securely in a DMZ, isolated from the rest of the network. Only a few people have administrative rights to these machines, and the only connection the Terminal Server machines have to the internal network is a port to a dedicated domain controller. To further separate the employee "free for all" TS machines from the corporate network, they even are connected to the Internet on a different link. Of course, the TS machines have a few outgoing ports blocked at the router (port 25, duh), but its nowhere near as locked down as the internal corporate network.
Now, desktops can be locked down, but users can do pretty much what they want on their account on the terminal server (Webmail, IM, etc.) If a user gets malware, it can only affect their user accounts (assuming the malware gets past the AV scanner resident on the machine.) There is no known way the internal PCs can be infected by a compromised terminal server (if by chance something like this occurs), and confidential corporate material can't get out by accident via the clipboard (if someone wanted to get it out, they could manually type it, but that is a different story altogether.)
Re: (Score:2)
Re: (Score:2)
Re:For business or personal use? (Score:5, Insightful)
Simply installing and updating a latest virus scanner on all corporate machines should be relatively simple.
Also, employees should be permitted to bring their own computers to use on the corporate network. How do you stop viruses?
1. Demand a periodic inspection of all Windows computers to ensure that the user is using an approved virus scanner that is set to automatically update.
2. Freely allow Linux machines to be plugged into the workplace. They are highly unlikely to cause any problems.
This is how at least two places I've worked at ran it, and employees were extremely happy.
Also, may I point out that my university (MIT) network has nearly no restrictions whatsoever on what you can plug in, what you can serve, and what you can run. I can run a mail server in the office if I want. I can run a web server in my dorm room. I can do essentially anything. The IS&T department here just has it structured pretty well so that nothing bad happens. Solid Unix/Linux servers, and automatic shut down of network drops that are spreading viruses or of Windows machines that appear vulnerable. It's great. I get freedom to do anything I want, and the network is very solid and reliable at the same time. I wish companies could do this too.
Re:For business or personal use? (Score:5, Interesting)
background: I've worked IT full/part time for about 10 years now (geez) from desktop to network admin to site managing
Statement: In my experience the number of network admins that have the ability to adequately and competently run a network that both allows computing freedom (in reference to how you are saying) and is secure is very small.
I'd also note that I've seen this setup work a lot better with Universities than with corporate environments. Mostly because, insofar as I can tell personally, the network/systems admins/engineers are more concerned with enabling safe but wide-ranging activities in the university environment, as opposed to the corporate environment, where anything not expressly allowed is forbidden.
Re: (Score:3, Insightful)
I see what you're saying, but there's a difference in needs and motivations between a university and most companies. Universities specifically need freedom because they're largely interested in education (ok, maybe not really, but at least supposedly). Education requires freedom. Plus, the constant re-evaluation of the setup is educational. When you have a whole bunch of aspiring CS majors and academics without a whole lot of real work to do, you have a free workforce to constantly address the ever-chan
Re: (Score:2)